I have heard quite a few opinions on this, but I am just curious if print files once sliced, are encrypted, then uploaded to the AWS servers, then downloaded to the printer, and the printer decrypts them?
I have checked my firewall and ran a few Wireshark tests to see how the data structure works, and I cannot tell if my files are encrypted before leaving. I read a white paper by bambu studios stating that in the United States they follow the laws and regulations here.
Any information and documentation supporting that they do encrypt the files before uploading to the cloud would be great
On my A1, on all firmwares so far up to current date, if I export a job to a .gcode.3mf, open that file, remove its print job gcode file A and replace it with another one file B, insert that SD card into my printer, and hit print, the machine sees it as the original job, will print that file, and the thing on my plate will be from file B. This is despite there being a .md5 checksum file of the gcode file inside the jobs file.
Encryptions only part of your problem if you’re diagnosing security, you need to verify integrity too cuz the machine will not.
While in transit, files are encrypted, by HTTPS protocol if nothing else (or other “S” variants of standard protocols, eg. MQTTS/FTPS). How they’re actually stored on MW, I have no idea, and not sure that’s relevant. When downloading a file from MW via browser, it is stored locally entirely unencrypted (after being en/decrypted via the usual HTTPS mechanisms). The push-to-printer/download mechanism must work in a similar fashion.
Integrity is indeed a somewhat different topic. I’m not sure where or if any of that is verified.
I am specifically talking about when you hit print plate on bamboo studio, and it needs to upload to the cloud first and then your printer downloads your sliced file to print it. I’m wondering if that process is encrypted as my file leaves the slicer goes to their cloud services and then back to my printer
Sorry, not sure where I got MW from. But yes, all communications with BL cloud are encrypted. Even in “LAN Only” and “Developer” modes the comms. with the printer are encrypted (MQTTS/FTPS).
I’m not sure about “no one.” Once the files get to the BL cloud, we don’t know what happens to them. BL must be able to decrypt them, however they’re delivered (same as your printer). They’re safe while in transit (eg. from someone sniffing packets), but at each destination (cloud, printer) they must, or can, be readable. I think that’s especially where the local laws they mention come into play.
If one cares about privacy, I’d say the cloud is a no-go. I don’t use their cloud at all.
Ok, with that in mind, if i go into LAN mode, i need way to stop the printer via my phone? I dont need to start prints from my phone, i just need a way to stop failed prints.
I am on Android
I have thought about using a vpn but then what app can i use over vpn view my printer?
Right, good question. Handy definitely won’t work.
With the printer in “Developer” mode, we (3rd party apps) can use MQTTS to communicate with the printer. And there are such applications out there (and/or plugins for “smart home” controllers like Home Assistant), typically involving a server somewhere on the LAN and web-based (or mobile app) clients for a UI. One could then use a VPN into their LAN (or map a NAT port) to access this server remotely.
What I don’t have is a specific recommendation as I’ve yet to try any of 'em. Hopefully someone else can chime in here.
I’d love something simple, and might end up coding something myself if it comes down to it. So far I haven’t really dared to leave a print running while “off premises” anyway.
-Max
PS. A “brute” approach of course could be to use a remote desktop app via VPN to view a Studio session. But yea…
As others have stated, a normal 3MF file is not encrypted. Technically, 3MF is a ZIP-based container, not some proprietary encrypted format. In practical terms, you can usually rename a .3mf file to .zip and open it with a normal archive utility. Inside, you will find XML, model data, thumbnails, and slicer metadata.
That is separate from whether the upload path to Bambu’s cloud is encrypted.
Encrypted transport is not the same thing as end-to-end file encryption. HTTPS would mean the traffic is encrypted in transit. It does not prove that the 3MF or G-code file itself is encrypted locally before upload in a way that only the printer can decrypt.
That distinction matters.
If the file goes through Bambu’s cloud, then you are trusting Bambu’s cloud process, access controls, retention policy, and implementation. Wireshark may show encrypted traffic, but encrypted traffic alone does not prove that the file is unreadable to Bambu.
So my practical answer is this:
If the file contains intellectual property, customer data, export-controlled content, or anything you would not intentionally hand to a third-party cloud service, do not use Handy or cloud printing. Use LAN-only mode or a local/removable transfer method.
Bambu may encrypt the transport. That is not the same as proving true end-to-end encryption of the print file.
Ah but does the printer still send it to the mothership in the cloud?
(I have no idea, just devil’s advocate talk. Could sniff that out probably, at least to see how much, if any, data is sent out after starting a print from card.)
Lol, bambu is almoat as bad as meta haha but according to another acquaintance, who did the same thing as me but more indepth, no data was transferred over the cloud when using sdcard and all video feeds stayed local and video over handy never touched a server.
Yeah, that was my concern, transit is encrypted but are my files e2e and it seema the answer is leaning towards no haha. But the sd card will be just fine. I can just turn of internet for a few minutes while i start the print or block the ip on my firewall for the printer and then unblock it after a few minutes so i can at least view it remotely
Great article, thanks for the link! I can confirm all the LAN Mode findings personally (it only queries NTP). And good details on the cloud-based tests, very nice. Would be good to repeat those tests once in a while probably, but sounds like local printing is pretty safe.
